In general, subscriber to corresponding services are authenticated.
There are many different authentication methods. In the following, a Challenge Response based authentication method is described in short as an example.
The network node which actually performs the authentication requests a parameter set consisting of a random number RAND (usually, 128 bit) and a scheduled result (RESP) from an Authentication Center (AuC) and sends the RAND to the mobile node. In turn, the mobile node (MS, mobile station) has to calculate a result RESP_CALC from the number RAND. The calculation is performed in the mobile node by using a secret algorithm. The user identity, the challenge and a key shared between the user and the authenticator are taken as inputs to an authentication algorithm, thus resulting in the expected output. The shared key must be kept private and only the user and the authenticator should know it; but the authentication algorithm can be publicly known.
The result RESP_CALC is transmitted to the network node performing a verification of the authentication. It checks whether the scheduled result RESP is equal to the calculated result RESP_CALC. If both results are equal, the authentication is successful, otherwise it fails.
In mobile applications, and in particular in cellular networks, the serving network (i.e. the network providing services to the mobile nodes) can typically authenticate the mobile node in three situations: when the mobile node registers with the network, when the mobile node establishes communications, and when incoming communications are terminated to the mobile node.
The invention applies to networks, such as, e.g., Voice over IP (VoIP) networks, where the SIP protocol is adopted as control protocol to setup multimedia communications, for example. In particular, the invention applies to the case of mobile VoIP networks where calls need to be delivered to mobile nodes.
The SIP protocol provides a mechanism to allow authentication of a SIP terminal when the terminal registers to a SIP server and when the terminal establishes a SIP call. Currently, SIP does not foresee any mechanism to support authentication of SIP calls delivered to the mobile node. That is, SIP, as currently defined, does not allow authentication of terminated calls.
Thus, in order to apply SIP to VoIP mobile network, authentication of mobile terminated calls need to be supported.